Skip to content
$1,000,000 in security audit grants are live now, Apply here →

Security review · July 2023

Synthetics V2, Review 7

for GMX

GMX engaged Guardian to review the remediation of issues surfaced during a prior engagement in July. From the 19th of July to the 28th of July, a team of 2 auditors reviewed the source code updates.

Published
Review window
July 19 to 28, 2023
Language
Solidity
Chains
Arbitrum, Avalanche
Sector
Perpetuals
  • 0 Critical
  • 0 High
  • 2 Medium
  • 3 Low
  • 0 Informational

5 acknowledged

Scope

Overview

GMX engaged Guardian to review the remediation of issues surfaced during a prior engagement in July. From the 19th of July to the 28th of July, a team of 2 auditors reviewed the source code updates.

Findings 5

  1. GSU-1 Medium Incorrect Decrease Gas Estimation Logical Error Acknowledged
    Location
    GasUtils.sol: 200-202

    Description

    When estimating the gas needed for a decrease order in estimateExecuteDecreaseOrderGasLimit, 1 is added to gasPerSwap instead of adding 1 to the swap length to account for the extra swap due to decreasePositionSwapType.

    Recommendation

    Add 1 to the order’s swap length rather than the gasPerSwap.

    Resolution

    GMX Team: The recommendation will be implemented in a future release.

  2. GLOBAL-1 Medium Positive Impact Misrepresented Logical Error Acknowledged
    Location
    Global

    Description

    During both increase and decrease orders, forPositiveImpact is determined based upon the priceImpactUsd being greater than 0, however this is based on the priceImpactUsd after it has been capped. In the event that the position impact pool is empty and the positive price impact value is capped to 0, the fees will be calculated with a forPositiveImpact of false, meanwhile the action does indeed balance the pool.

    Recommendation

    Compute forPositiveImpact before the price impact is capped so that actions that balance the pool receive the corresponding configured fees.

    Resolution

    GMX Team: The recommendation will be implemented in a future release.

  3. EDPU-1 Low Inefficient If Case Optimization Acknowledged
    Location
    ExecuteDepositUtils.sol: 401

    Description

    The price impact logic is split into two if cases where the first one accounts for positive price impact and the second accounts for negative price impact. If the first _params.priceImpactUsd > 0 condition is met, the second _params.priceImpactUsd < 0 condition cannot be met, however this condition is still subsequently checked.

    Recommendation

    Use an else if (_params.priceImpactUsd < 0) condition to avoid checking if the priceImpactUsd is negative if it was already found to be positive.

    Resolution

    GMX Team: Acknowledged.

  4. OCL-1 Low Outdated NatSpec Documentation Acknowledged
    Location
    Oracle.sol: 56-65

    Description

    The NatSpec does not match the struct parameters. Missing parameters include:

    • info
    • minBlockConfirmations
    • maxRefPriceDeviationFactor
    • validatedPrices

    Recommendation

    Update the NatSpec to reflect the struct accurately.

    Resolution

    GMX Team: NatSpec will be updated in a future release.

  5. DPCU-1 Low Typo Typo Acknowledged
    Location
    DecreasePositionCollateralUtils.sol: 590-593

    Description

    “[t]he difference would be in the stored as a…” should be edited to “the difference would be stored as”.

    Recommendation

    Edit the comment described above.

    Resolution

    GMX Team: The typo will be fixed in a future release.

More from GMX

All 44 reports
  1. Timelock Updates

    4 findings 4 findings: 3 low, 1 informational
  2. LayerZeroProvider Routing

    1 finding 1 finding: 1 medium
  3. Open Interest Updates

    5 findings 5 findings: 2 medium, 3 low
  4. Updates Branch

    2 findings 2 findings: 2 low

Put your code through the same review.

This review started with a conversation about scope. Tell us what you are building and we will plan yours with you.

Get a quote